https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 12:22:28 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-103059 <p>When Gitea&#39;s built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user&#39;s registered RSA public key for which they can derive the private key could have that key matched to the victim&#39;s account and authenticate over SSH as that user. Keys are now looked up by fingerprint.</p> <p>When Gitea&#39;s built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user&#39;s registered RSA public key for which they can derive the private key could have that key matched to the victim&#39;s account and authenticate over SSH as that user. Keys are now looked up by fingerprint.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-103059